160 Million Identity Records Allegedly Resold Across Dark Web After IDScan Exposure
Summary
DarkOwl traced the resale of a dataset advertised as more than 160 million North American identity documents. IDScan disclosed possible unauthorized access, but DarkOwl could not independently confirm the dataset came from the company.
Key points
- A seller on Exploit advertised persistent access to more than 160 million North American IDs and over 10 million other identity documents.
- A sample document was confirmed as authentic by the person it belonged to, but this does not independently verify the advertised dataset’s full scope or source.
- IDScan disclosed possible unauthorized access to data in its cloud environment, including names and government ID numbers, and said it was cooperating with federal law enforcement.
- DarkOwl could not independently confirm that the dataset advertised on Exploit came from IDScan; later sellers named the company as the source.
- After the original Nexus listing disappeared, similar offers appeared on other forums, a storefront and Telegram, with differing prices and copied listing details.
- DarkOwl cautioned that seller-listed customer organizations were not verified as affected and that criminal sellers may use high-profile leaks to scam buyers.
Article Details
- Victim Organization
- IDScan
- Incident Type
- Possible unauthorized access to data stored in IDScan's cloud environment; a dataset alleged to have come from IDScan was subsequently marketed and resold.
- Disclosure Date
- 2026-09-04
- Data Types Exposed
- Full names
- Driver's license numbers
- Numbers from other government-issued IDs
- Driver's licenses and identification cards
- International IDs
- Travel documents
- Residency cards
- Medical cards
- Barcode data
- Front-and-back document scans, in some cases under regular, UV, and IR light
- Affected Records
- Sellers advertised more than 160 million North American driver's licenses and identification cards, plus over 10 million additional documents. These figures are claims and were not independently confirmed by DarkOwl.
- Operational Impact
- IDScan said it identified possible unauthorized access to data in its cloud environment and was cooperating with federal law enforcement. The article reports no operational disruption.
- Ransom Or Extortion
- No ransom demand or extortion against IDScan is reported. Sellers advertised the dataset for sale, with reported prices ranging from $6,000 to $500,000.
- Claim Status
- alleged
People
Threat Actors
databroker1Exploit forum account that advertised the dataset and claimed persistent access to an identity-verification company and its customers; the claimed access and dataset source were not independently confirmed by DarkOwl.ShinyHuntersAn account using this alias advertised the dataset and named IDScan as its source; the article does not independently verify the account's access to the data.
Vendors
Industries
Automotiveclaimed were impacted as customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others.financeimpacted as customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others.Gamingas customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others.Hospitalitythey claimed were impacted as customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others.Identity verificationaccess to a proprietary database of breached identity documents, reportedly pulled from an identity verification vendor and its client base.Retailof organizations they claimed were impacted as customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others.